OutSystems Lifetime authorization bypass disclosed
CVE-2026-40127 allows authenticated users to bypass authorization and read change logs and application names for any application in OutSystems Lifetime; patched in version 11.28.2.3955.
CERT Polska coordinated disclosure of an authorization bypass vulnerability in OutSystems Lifetime software. The flaw, tracked as CVE-2026-40127, stems from insufficient validation of a user-controlled ApplicationID parameter, allowing any authenticated user to access change logs and application metadata they should not be authorized to view.
The vulnerability enables authenticated attackers to read change logs containing actions performed by other users as well as application names for any application in the environment. This represents a privilege escalation within the platform, though exploitation requires existing authentication.
OutSystems has addressed the issue in Lifetime version 11.28.2.3955. The vulnerability was responsibly disclosed by Zbigniew Piotrak of the AFINE Team through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
OutSystems Lifetime ApplicationID Parameter Enumeration Attempt
Detects HTTP requests to OutSystems Lifetime endpoints manipulating the ApplicationID parameter, which may indicate probing for the authorization bypass (CVE-2026-40127) allowing access to other applications' change logs and metadata; investigate for a single authenticated user rapidly requesting many distinct ApplicationID values in a short window. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OutSystems Lifetime ApplicationID Parameter Enumeration Attempt
logsource:
category: webserver
product: windows
detection:
selection:
cs-uri-query|contains:
- ApplicationID=
cs-uri-stem|contains:
- /lifetime/
condition: selection
fields:
- c-ip
- cs-username
- cs-uri-stem
- cs-uri-query
- time
falsepositives:
- Legitimate administrators browsing multiple application change logs during normal
audit or governance activities
- Automated monitoring/reporting integrations that iterate over ApplicationID values
for legitimate inventory purposes
level: medium
tags:
- attack.t1213
- attack.privilege_escalation
- cve.2026.40127
id: d7141d19-6526-58d8-91eb-640a40849b7e
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-40127
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free